How to pass static string via lookup to stats command?

[dfphere]

I'm attempting to utilize a lookup to pass static strings to create 'stats' commands. The result is sent to the search but it's treated as a large string instead of the various  values/statistical operations that are part of the search. I'm wondering if there's a way to get Splunk to interpret the command as intended.

[bowesmana]

Unfortunately it can't (yet) be done - I created a Splunk idea a couple of years ago for this

https://ideas.splunk.com/ideas/EID-I-398

but it's not been adopted - although marked as 'future prospect'.

[dfphere]

Bummer, but I upvoted to help the cause. Any chance you found a work around?

[bowesmana]

Sadly no workaround - the idea of using externally defined control strings to influence SPL just isn't practically possible other than in the way represented in the idea.

I guess the 'workaround' is to try to understand your use case to see why you are trying to do that anyway and whether you really need it.

You can do some generic stuff with macros, but even then, not really dynamically, as macros are expanded _before_ the search is executed, so cannot take account of field values in the pipeline

😞